IPS versus performance of 1000c

[pj255]

Hi all, Does anybody know of roughly what sort of performance impact one could expect by enabling IPS scanning for some traffic flows on a 1000c? Does the the size of the IPS signature list directly affect the type of performance impact? The 1000c has just one NP4 processor and im assuming the IPS traffic needs to be handled by the CPU..also im assuming that the larger the list is and the greater the traffic = the higher the resource impact on the FG ? PJ

[pj255]

Great info guys - the logging will be important as we plan to send some syslog events to our McAFee SIEM in a few months for compliance. Il need to read up on the 5.2 upgrade - flow mode im guessing hits the processor once and is hardware processor for the followng transactions....I guess il read it to find out ;)